CORS Policy
Cross-Origin Resource Sharing policy for the TotalAccess API
Overview
The TotalAccess API supports Cross-Origin Resource Sharing (CORS) for browser-based integrations. The CORS policy varies based on the authentication method used.
Allowed Origins
| Authentication | Origin Policy | Credentials |
|---|---|---|
API Key (X-API-Key) | * (wildcard) | Not allowed (no cookies) |
Bearer JWT (Authorization) | Restricted to known origins | Allowed (same-origin) |
API key-authenticated endpoints use Access-Control-Allow-Origin: * because
API keys are sent via headers (not cookies), so credential-based CORS restrictions
don't apply. JWT-authenticated endpoints restrict origins to prevent CSRF.
Allowed Headers
Content-Type
Authorization
X-API-Key
Idempotency-Key
X-API-Version
X-Requested-With
X-Session-Token
X-App-ID
X-Client-ID
X-Portal
X-App-Version
X-Inspection-TokenAllowed Methods
GET
POST
PUT
PATCH
DELETE
OPTIONSPreflight Cache
Preflight (OPTIONS) responses include:
Access-Control-Max-Age: 86400This allows browsers to cache preflight responses for 24 hours, reducing preflight request overhead.
Rate Limit Headers
The following rate limit headers are exposed to JavaScript:
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-ResetExample Preflight Request
OPTIONS /api/v1/public/data HTTP/1.1
Origin: https://your-app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: X-API-Key, Content-Type, Idempotency-KeyResponse
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, PATCH
Access-Control-Allow-Headers: Content-Type, Authorization, X-API-Key, Idempotency-Key, X-API-Version, ...
Access-Control-Max-Age: 86400Requesting Additional Origins
For JWT-authenticated endpoints that require specific origins, contact
[email protected] to add your origin to the allowlist.
Configuration
CORS is managed by the withCors middleware in the Next.js application.
All API routes are automatically wrapped with CORS support.
Adding New Headers
If you need a custom header to be allowed, it must be added to the
Access-Control-Allow-Headers list in:
src/lib/withCors.ts—corsOptionsHandler(preflight)src/lib/withCors.ts—withCorswrapper (actual responses)